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Abstract 

A protocol for quantum bit commitment is proposed. The protocol 
is feasible with present technology and is secure against cheaters with 
unlimited computing power as long as the sender does not have the 
technology to store an EPR particle for an arbitrarily long period of 
time. The protocol is very efficient, requiring only tens of particles. 
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Quantum cryptography was initiated by the pioneering work of Wiesner 
in late Sixties (his paper, however, was not published until 1983 [|IJ). Over 
the past two decades, many applications of quantum cryptography have been 
discovered One of the most outstanding applications of quantum 

cryptography is quantum bit commitment. 

The interest in bit commitment is motivated by a recent trend in cryp- 
tographic research to reduce or more preferably to eliminate the complexity 
assumptions from the protocols. Many protocol problems that were previ- 
ously solved subject to complexity assumptions are now being solved without 
these assumptions. These breakthroughs demonstrate the weaknesses of the 
unproven complexity assumptions. One way of eliminating the complexity 
assumptions from a protocol is to build the protocol using a small set of rel- 
atively simple primitives. The security of the protocol then entirely depends 
on the security of its primitives. One of the most fundamental primitives is 
the bit commitment. The extreme generality and usefulness of bit commit- 
ment primitive has been demonstrated by several authors H. 

Let us briefly review the goal of the bit commitment protocol: 

(1) Alice has a bit A in mind to which she would like to be committed toward 
Bob. 

(2) Bob should not learn any information about A before Alice opens up the 
commitment. 

(3) Alice should not be able to change the value of A after the commitment. 
In the past, several bit commitment protocols based on complexity as- 
sumptions have been proposed. However, none of these protocols are safe 
against cheaters with unlimited computing power. Bit commitment protocols 
based on uncertainty principle have also been proposed^ || pj. However, 
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all these protocols are insecure against EPR attack [8-11]. In this paper, we 
describe a new and efficient quantum bit protocol which requires only tens of 
EPR particles and is feasible with present technology. However, the present 
protocol, similar to previous schemes, is not secure against a cheating Al- 
ice who has the technology to store an EPR particle for an arbitrarily long 
period of time. 

Before proceeding, it is useful to review some elementary features of quan- 
tum mechanics. We consider a pair of particles in the EPR entangled state 
I*) = ^(ITT>+ |U». After particles are spatially separated, the spin of 
the first (second) particle (m b 2 ) is measured along an arbitrary axis a (b), 
with the z axis being along the direction of flight of particles. If the spin of 
the first (second) particle is up, then m\ = 1 (m\ = 1), and if the spin of 
the first (second) particle is down, then m\ — — 1 {m\ = —1). The expected 
value of the product of the spins of the particles is 

E^(a,b) = ($ | o\o\ | $) (1) 
= cos 9i cos 6> 2 + sinOi sin 62 cos (0i + ^2) , 

where 61(62) is the polar angle between a (bj and the z axis, and 0i(02) is 

the azimuthal angle between a (bj and the x axis. Similarly for a pair of 

particles in the EPR entangled state | $') = 4- (|ff )- III)) , 

v 2 

E^(a,b) = ($' I o\o\ I $') (2) 
= cos 6\ cos 62 — sin6\ sin 62 cos (0i + 02 ) • 

For a pair of particles in the entangled state | = -X= (||f) + i |||)) , 

V2 

Ev(a,b) = (*|(rXl*> (3) 
= cos #1 cos ^2 + sin6\ sin ^ 2 sin (0i + 2 ) • 



Finally for a pair of particles in the entangled state | ty') = (|tt) — * III)) , 

E*,(a,b) = (*'| a\a\ | (4) 
= cos #i cos #2 — sm#i sin 9 2 sin (0i + 2 ) • 

For states | $), | $'), | \1/), and | ^/'), the probability that the product of the 
spins of the two particles m^m^ is +1 or —1 is 

p(m?m$ = l) = i±^M, ( 5 ) 

p(m?m$ = -l) = 

With the above in mind, we now proceed to describe a quantum bit com- 
mitment protocol based on EPR states. Alice and Bob initiate the following 
steps: 

(1) Alice and Bob agree on a security parameter n. They also agree that if 
Alice wants to be committed to bit A = 1, then she prepares a sequence of n 
states, randomly chosen from |$) or |$'), and if she wants to be committed 
to bit A = 0, then she prepares a sequence of n states, randomly chosen from 
|\&) or \^>'). They also agree on a security parameter n. 

(2) Bob chooses a vector B = (6>i, 9' 1: 0i, (/)[, . . . , 9 n , 9' n) n , 4>' n ) such that 9i, 6>-, 
<f>i, and <\)\ satisfy one of the following relations: 

(1) 9 t = 9\ = 90° and 0, + # = 0°, 

(2) 9i = 9\ and 0, + & = 0°, 

(3) 9i + 9\ = 180° and & + $ = 0°, 

(4) A* = 0< = 90° and 0, + # = 90°, 

(5) 0i = 9\ and 0, + # = 90°, 

(6) 0i + 9[ = 180° and 0; + # = 90°. 



Bob will measure the spin of the first (second) particle at polar angle #j(#-) 
and azimuthal angel He keeps the vector B secret. 

n 

(4)Do Alice sends the ith EPR pair to Bob. Bob measures the spin of the 

i=l 

first particle, ml, along axis a at polar (azimuthal) angle 6*j(0j) and spin of 
the second particle, m\, along axis b at polar (azimuthal) angle 9' i (4>' i ). Bob 
keeps the results of his measurements secret. 

Note that Bob does not learn any information about the bit A since if 
Alice selects states | <3>) or |<3>'), then 

a b 1 ( l + E*(a,b) 1 + Ey(a,b) , 
v {m\m\ = 1) = - I + | , ((.)) 

1 + COs9\COs9 2 
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1 — rr, 

p(m\m\ = -1) = - 



a b ., . i - cos9icos9 2 



and if she selects states | ^) or | ^'), then 



a b , 1 + cos9icos9 2 



p(mX = 1) = ^ (7) 

tab i \ 1 ~ cos9icos9 2 
p{m 1 m l = — 1) = . 



Thus according to the standard rules of quantum mechanics, Bob does not 
learn any information about Alice's bit no matter along which axis he per- 
forms his measurement. 

We now consider the opening of the commitment. Alice and Bob initiate 
the following steps: 

(1) Alice reveals the bit A to Bob [As previously stated, A = 1 indicates that 
Alice has chosen state | $), or | $'), and A = indicates that Alice has chosen 
the state | or |^')]. 

n 

(2) If A = 1, then DO Bob checks that if the ith EPR state is | $), then 



m\m\ = 1 whenever 9i — 9\ = 90° and 0i + <^ = 0°, and whenever 9{ = 9\ and 
+ = 0°. If the ith EPR state is is | $'), then Bob checks that ra\m\ = — 1 
whenever 9 { = 9\ = 90° and <fo + 0- = 0°, and whenever ^ + ■ = 180° and 

& + # = 0°- 

n 

If A = 0, DO Bob checks that if the ith EPR state is I \&), then m\m\ = 1 

i=l 

whenever 9i = 9\ = 90° and 4>i + 4>'i = 90°, and whenever 9i = 9\ and 
0^+0'. = 90°. If the ith EPR state is is | then Bob checks that m\m 2 h = -1 
whenever 9 t = 9\ = 90° and + & = 90°, and whenever 9i + 9\ = 180° and 
4 + 0' 4 = 9O°. 

(3) If these conditions are satisfied, then Bob accepts that Alice had indeed 
committed to the bit A. 

We now show that the above bit commitment protocol is perfectly secure 
against cheaters with unlimited computing power provided Alice does not 
have the technology to store an EPR particle for an arbitrarily long period 
of time. First we note that if Alice is honest, and if no transmission errors 
occur ||12|| , then condition (2) is always satisfied. Now suppose that a cheating 
Alice tries to commit in a way that will enable her to change A at a later 
time. In order to achieve this, she must tell Bob that she had selected (for 
example) state | $), when in reality she had committed to the state | 
Consider an instance when Bob measures the spin of the first particle along 
axis a and the spin of the second particle along axis b, and obtains m\rr^ 2 = 1. 
If she cheats and tells Bob that she had used | $), then the probability that 
her guess is correct is |. Therefore, in the long run, the probability that Alice 
cheats and succeeds is f |J 2 [note that Bob uses approximately ^ particles 
to reach a decision: When Alice tells Bob that she has committed to state 
| $) or | $'), then Bob considers only instances when 0j + <^ = 0° which 
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happens for approximately ^ particles. Similarly when Alice tells Bob that 
she has committed to state | \P) or | ^/'), then Bob considers only instances 
when (pi + = 90° which again happens for approximately ^ particles]. For 
sufficiently large security parameter n, the probability of success of a cheating 
Alice can be made arbitrarily small. 

We now show that the proposed protocol is not secure against EPR attack 
(see also [8-11]), that is, we show that the protocol is not secure against 
a cheating Alice who has the technology to store the third particle of the 
following EPR state \ A) = (|Ttt)+ HID) f° r an arbitrarily long period 
of time. We consider a spin variable at polar angle 9 and at azimuthal angle 
along direction n. The states of spin- up ||) and spin-down ||) can be 
expanded in terms of the states of spin-up | +) and spin-down | — ) along 
direction n so that we have the expressions 

|t) = [cos (0/2) | +) - sin (6/2) | -)] , 

||) = e ("^ 2 ) [sin (9/2) | +) + cos (9/2) | -)] . (8) 

By expanding |f) and ||) in terms of | x) and | — x), we obtain 

lT> = ^(l*>-|-*», 

\i) = ^(\x)+\-x)). (9) 
Similarly by expanding |f) and ||) in terms of | y) and | — y), we obtain 

IT> = *^(lv>-|-v», 

U> = *^(lv> + |-v»- (io) 

Using Eqs. (9) and expanding the third particle of state | A) in terms of 
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I x) and | —x), we obtain 

l^> = \ [ITT) (|*> - \-x))\ + \ [||D (\x) + | . (11) 

Rearranging the terms, 

\A) = ±=\\<P)\x)-\<P')\-x)]. (12) 

Similarly by expanding the third particle of state | A) in terms the | y) and 
\ — y), we obtain 

\A) = ^H')\y)-m\-y)}. (13) 

Now if Alice wants to pretend that she had committed to bit 0, that is, if she 
wants to pretend she had chosen states | <£>) or | $'), then she measures the 
spin of the third particle along the x axis. If the result of her measurement is 
1 (—1), then she tells Bob that she had chosen state | $) (!$'))• Similarly if 
Alice wants to pretend that she had committed to bit 1, that is, if she wants 
to pretend that she had chosen states | \P) or | ty'), then she measures the 
spin of the third particle along the y axis. If the result of her measurement 
is 1 (—1), then she tells Bob that she had chosen state | (| \&)). 

In summary, we have shown that the present protocol is secure even 
against cheaters with unlimited computing power, However, the proposed 
scheme is not secure against a cheating Alice who has the technology to 
store an EPR particle for an arbitrarily long period of time. 

I am grateful to H. K. Lo for helpful discussions. I also thank D. Mayers 
for sending me his unpublished results on the insecurity of all bit commitment 
protocols. 
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